In June 2026 the European Commission published its Tech Sovereignty Package, including the revised Open Source Strategy and the proposed Cloud and AI Development Act. Both lean on open source solution catalogues and on connecting the ones Europe already runs. What neither builds is the data layer underneath: the CRA, NIS2, DORA and the AI Act each demand supply-chain or sovereignty evidence, and none defines a standard format. Every regime mandates evidence; no regime says what it looks like.

This talk argues the procurement barrier is institutional, not legal — the directives already permit non-price criteria; they collapse to price because qualitative judgments are too costly to defend against challenge, and because a single proprietary vendor hands the buyer pre-packaged evidence while the equivalent open source facts sit scattered across forges, package registries and contributor records. Procurement defaults to the incumbent not because it is better, but because it is easier to document.

The instrument presented closes that gap by evolving publiccode.yml into a decentralised evidence layer: supply-chain references (SBOM, OpenSSF Scorecard, security policy) that make CRA/NIS2 artifacts double as procurement quality signals; project-endorsed contribution-credit registries that turn "Made in Europe" from vendor self-declaration into verifiable upstream evidence; usage registries that make "widely deployed yet under-funded" a queryable signal for sovereignty funding. Registries are themselves discoverable, so any catalogue can aggregate from any conforming one — federation with no central gatekeeper, the same pattern already feeding national catalogues into the EU Open Source Catalogue today. One honest caveat frames the ask: today publiccode.yml is used almost exclusively by open source software developed in or for the public sector, because the catalogues that mandate it reach no further. The evolved sections are designed to change that: supply-chain references, contribution credits and usage declarations give any open source project a concrete reason to publish the file, not only software already sitting in a government catalogue.

A design principle keeps it durable: the standard defines what is collected and how, never metrics, thresholds or scores. Interpretation belongs to consumers and jurisdictions — and catalogues bring their own perspective on top, through the data sources they connect, the filters they offer and the scoring algorithms they apply. The standard's neutrality is what lets those differing perspectives coexist over the same evidence.

The close is practical: three concrete asks by audience role — vendors publish a complete publiccode.yml and point at their contribution credits; public buyers ask for machine-readable evidence in their next tender, defensibly, now; catalogue and forge operators crawl the usage declarations and adopt the supply-chain section. Leading by example in digital sovereignty starts with making sovereignty measurable.